Case 3:16-cr-05110-RJB Document 180 Filed 03/16/17 Page 1 of 7 1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT TACOMA 8 9 10 11 UNITED STATES OF AMERICA, Plaintiff, 12 13 14 v. DAVID TIPPENS, ORDER ON GOVERNMENT’S MOTION SEEKING CLARIFICATION OF THIS COURT’S ORDER DISMISSING COUNTS 1 AND 3 OF THE SUPERSEDING INDICTMENT Defendant. 15 16 CASE NO. CR16-5110 RJB THIS MATTER comes before the Court on the Government’s Motion Seeking 17 Clarification of This Court’s Order Dismissing Counts 1 and 3 of the Superseding Indictment. 18 Dkt. 172. On March 15, 2017, the Court orally granted the Government’s motion. Dkt. 175. This 19 clarification follows. 20 The Government frames its request for clarification as a binary choice: 21 With respect to the Court’s order dismissing Counts 1 and 3 of the Superseding Indictment [orally on March 14, 2017] . . . the government seeks clarification on whether the Court’s [oral ruling on March 14, 2017, dismissing Counts 1 and 3] was based solely on the documents that the defense presented to the government as possible exhibits after the government had rested its case, or whether the Court has now reconsidered its 22 23 24 ORDER ON GOVERNMENT’S MOTION SEEKING CLARIFICATION OF THIS COURT’S ORDER DISMISSING COUNTS 1 AND 3 OF THE SUPERSEDING INDICTMENT- 1 Case 3:16-cr-05110-RJB Document 180 Filed 03/16/17 Page 2 of 7 1 November 30, 2016, order denying the defense motion to exclude related discovery surrounding the NIT as a result of these documents. 2 Dkt. 172 at 1, 2. In fact, the Court based its decision on the record in its entirety, including the 3 prior classified proceedings and the presentation of evidence at trial, but did not reconsider the 4 prior order, which was correct based on the information then before the Court. 5 In the Court’s November 30, 2016, Order on Defendant’s Motion to Exclude Evidence, 6 the Court addressed several discovery requests under the Classified Information Procedures Act 7 (CIPA) §§2, 4, 18 U.S.C. App. 3 §§2, 4, including Defendant’s request for the opportunity to 8 review the NIT code in its entirety. Dkt. 106 at 18-29. Defendant then theorized that the chance 9 to review the NIT code was relevant and helpful to determine, inter alia, whether the NIT code 10 had rendered Defendant’s computer and storage devices vulnerable to hacking by a third party 11 that may have “planted” child pornography or compromised computer security settings. Id. at 25, 12 26. The order followed an ex parte and in camera hearing. See Dkt. 86. Applying the three-part 13 test of Sedaghaty, 728 F.3d 885, 904 (9th Cir. 2013), the Court found that although the NIT code 14 was material, the Government did not need to produce the NIT code, because it was classified 15 and not relevant and helpful to the defense. Id. at 18-29. 16 In a Second Motion to Compel Discovery (Dkt. 108), Defendant argued that a “patch” to 17 the Mozilla Firefox browser could have eliminated the vulnerability exploited by the NIT code, 18 thus eliminating the Government’s interest in not disclosing the code. The Court construed 19 Defendant’s motion as a motion for reconsideration of the Order on Defendant’s Motion to 20 Exclude. Dkt. 114 at 2. The Court rejected the argument because, even if Defendant was correct, 21 the NIT code’s classified status had not changed, and the Court lacks the authority to re-classify 22 a designation made by the Executive Branch. Id. at 2. 23 24 ORDER ON GOVERNMENT’S MOTION SEEKING CLARIFICATION OF THIS COURT’S ORDER DISMISSING COUNTS 1 AND 3 OF THE SUPERSEDING INDICTMENT- 2 Case 3:16-cr-05110-RJB Document 180 Filed 03/16/17 Page 3 of 7 1 On March 1, 2017, the parties filed a signed stipulation, the Stipulation of the Parties 2 Regarding the NIT and Related Matters. Dkt. 154. The stipulation stated that the NIT was an 3 “exploit” used by the FBI and that “[i]t is possible that an exploit could make temporary or 4 permanent changes to the security settings of a user’s computer that could allow someone to 5 subsequently run commands . . . without the user’s knowledge.” Id. at ¶¶4, 6. 6 Ruling on a defense pretrial motion to preclude reference at trial by the Government to 7 the NIT code, on March 3, 2017, the Court orally granted the motion in part, prohibiting the 8 Government from referencing the NIT code in its case in chief. The Government did not take 9 issue with the Court’s ruling, but if the Defendant “opened the door,” the Government requested 10 permission to present a rebuttal witness, who, the Government maintained, could testify that 11 Defendant’s computer and devices showed no signs of being hacked with planted child 12 pornography or modified security settings. Dkt. 158 at 12-15. 13 At trial, the Government proceeded to prosecute Defendant for three child pornography- 14 related charges: Receipt (Count 1), Possession (Count 2), and Transportation (Count 3). Neither 15 party completely refrained from inquiring about third party vulnerabilities. For example, defense 16 counsel asked FBI Agent John Powers whether he agreed with ¶6 of the NIT stipulation (Dkt. 17 154). Draft of Trial Transcript, 3/14/17am, p. 3. The Government asked the same witness about 18 “complicated” timestamps and whether the witness had observed anything in his examination of 19 Defendant’s computer and devices that led him to conclude timestamps were inaccurate or 20 tampered with. He had not. Id. at p. 39. 21 After the Government rested its case in chief, Defendant disclosed to the Government and 22 the Court proposed exhibits, purportedly from Wikileaks, that Defendant intended to offer to 23 counter allegations of Receipt (Count 1) and Transportation (Count 3). According to Defendant, 24 ORDER ON GOVERNMENT’S MOTION SEEKING CLARIFICATION OF THIS COURT’S ORDER DISMISSING COUNTS 1 AND 3 OF THE SUPERSEDING INDICTMENT- 3 Case 3:16-cr-05110-RJB Document 180 Filed 03/16/17 Page 4 of 7 1 the proposed exhibits contained information regarding the Government’s ability to hack into a 2 computer without leaving any trace that it had been hacked or that an exploit had been placed on 3 it. The proposed exhibits, Defendant argued, set up the argument that even if Defendant 4 completed a thorough forensic examination of Defendant’s computer and devices, Defendant 5 would not be able to determine whether child pornography had been planted or whether security 6 settings had been modified. (Referred to herein as a “hack.”) The proposed exhibits, in other 7 words, would directly confront the probative value of the Government’s repeated assertion that 8 the computer and devices showed no signs of a third party hack, which proved there was no 9 hack. 10 In response, the Government requested that the proposed exhibits be excluded from trial 11 because of their classified content. The Government also objected to the proposed exhibits based 12 on their late disclosure. Defendant argued that the proposed exhibits, although technically 13 classified, were publicly available on Wikileaks; that the proposed exhibits pointed to 14 misrepresentations by the Government about the NIT code; and that the proposed exhibits 15 included material that should have been provided as discovery. The Court orally granted the 16 Government’s request, based on the Government’s statement that the proposed exhibits were 17 classified. Defendant was not allowed to offer the proposed exhibits. 18 Following that oral ruling, Defendant made a motion to dismiss Counts 1 and 3 under 19 CIPA §6, 18 U.S.C. App. 3 § 6(e)(2). The Court granted the motion and dismissed both counts. 20 *** 21 CIPA §6 provides: 22 (2) Whenever a defendant is prevented by an order under paragraph (1) from disclosing or causing the disclosure of classified information, the court shall dismiss the indictment or information, except that, when the court determines that the interest of justice should not be served by dismissal of the indictment or information, the court shall order such 23 24 ORDER ON GOVERNMENT’S MOTION SEEKING CLARIFICATION OF THIS COURT’S ORDER DISMISSING COUNTS 1 AND 3 OF THE SUPERSEDING INDICTMENT- 4 Case 3:16-cr-05110-RJB Document 180 Filed 03/16/17 Page 5 of 7 1 other action in lieu of dismissing the indictment or information, as the court determines is appropriate. Such action may include, but need not be limited to – 2 3 4 5 (A) Dismissing specified counts of the indictment or information; (B) Finding against the United States on any issue as to which the excluded classified information relates; or (C) Striking or precluding all or part of the testimony of a witness. In support of its dismissal of Counts 1 and 3 under CIPA §6, the Court finds that the 6 interests of justice are served by this dismissal action. At its own peril, the Government elected 7 to prosecute Receipt and Transportation counts partially reliant on evidence of timestamp 8 metadata, while also electing to withhold NIT code and Defendant’s proposed exhibits. 9 Withholding the material effectively prevented Defendant from presenting his proposed exhibits 10 in support of Defendant’s vulnerability theory, that there was an increased likelihood of a third 11 party hack in the form of planted contraband or modified security settings. Withholding also 12 limited Defendant’s ability to attack the Government’s long-held position that “reverse 13 engineering” Defendant’s computer would reveal that there was no third party attack. See, e.g., 14 Dkt. 58-1 at 5, 6 (declaration of Dr. Brian Levine); Dkt. 102 at 67 (testimony of Dr. Brian 15 Levine); Dkt. 103 at 64, 65 (oral argument). Finally, withholding precluded Defendant from 16 relying on the proposed exhibits to attack the Government’s credibility as to representations 17 made at ex parte and in camera CIPA hearings, and the Court’s earlier finding that the NIT code 18 was not “relevant and helpful” to the defense. 19 In other words, the NIT code was material to the defense, and “[i]n cases where the 20 defendant has demonstrated materiality, the district court should not merely defer to government 21 assertions that discovery would be fruitless.” United States v. Budziak, 697 F.3d 1105, 1112-13 22 (9th Cir. 2012). Defendant should not be required “to rely solely on the government’s word that 23 24 ORDER ON GOVERNMENT’S MOTION SEEKING CLARIFICATION OF THIS COURT’S ORDER DISMISSING COUNTS 1 AND 3 OF THE SUPERSEDING INDICTMENT- 5 Case 3:16-cr-05110-RJB Document 180 Filed 03/16/17 Page 6 of 7 1 further discovery is unnecessary.” Id. The interests of justice are served by dismissing Counts 1 2 and 3 under such circumstances. 3 The Government’s request for clarification specifically references the Court’s November 4 30, 2016, Order on Motion to Exclude Evidence. When considering whether requiring the 5 Government to provide the NIT code would be relevant and helpful to Defendant’s vulnerability 6 theory (Dkt. 106 at 25, 26), the Court rejected Defendant’s theory because (1) Defendant had not 7 yet conducted forensic investigation of the computer and storage devices; (2) the Government 8 represented in open court that the portions of the NIT already disclosed would be sufficient to 9 determine the vulnerability (Dkt. 58-1 at 5, 6 (declaration of Dr. Brian Levine); Dkt. 102 at 67 10 (testimony of Dr. Brian Levine); Dkt. 103 at 64, 65 (oral argument)); and (3) Defendant had 11 presented no factual evidence beyond the theoretical in support of his theory. Dkt. 106 at 26. 12 The presuppositions that formed the basis of the Court’s pretrial “relevant and helpful” 13 finding, have since been eroded, because (1) Defendant represents that his experts have 14 conducted a forensic investigation insofar as it is possible (Dkt. 102 at 92; Dkt. 164 at 9); (2) the 15 Government may have misstated the relationship of the NIT code to Defendant’s vulnerability 16 theory; and (3) Defendant’s proposed exhibits at trial may have added to Defendant’s otherwise 17 meager showing in support of Defendant’s vulnerability theory. By the Government’s 18 withholding of the proposed exhibits, Defendant has been prevented from examining into these 19 material issues, which may have strengthened Defendant’s argument on reasonable doubt. 20 21 *** Accordingly, for the reason that the United States has withheld classified material that is 22 material to the defense, the interest of justice required that Counts 1 and 3 be DISMISSED. 23 24 IT IS SO ORDERED. ORDER ON GOVERNMENT’S MOTION SEEKING CLARIFICATION OF THIS COURT’S ORDER DISMISSING COUNTS 1 AND 3 OF THE SUPERSEDING INDICTMENT- 6 Case 3:16-cr-05110-RJB Document 180 Filed 03/16/17 Page 7 of 7 1 The Clerk is directed to send uncertified copies of this Order to all counsel of record and 2 to any party appearing pro se at said party’s last known address. 3 4 5 6 7 Dated this 16th day of March, 2017. A ROBERT J. BRYAN United States District Judge 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 ORDER ON GOVERNMENT’S MOTION SEEKING CLARIFICATION OF THIS COURT’S ORDER DISMISSING COUNTS 1 AND 3 OF THE SUPERSEDING INDICTMENT- 7